fix(m365): emit a single MANUAL finding when PIM stale alert is unavailable

The previous behavior fanned out a FAIL finding for every Organization the
tenant returned whenever the stale sign-in alert was missing from the API
response. That conflates three distinct conditions — no Microsoft Entra ID
P2 license, alert disabled, or insufficient permission — into the same
verdict, penalizes tenants without PIM, and emits N near-duplicate findings
for what is logically a single tenant-level state.

Emit a single MANUAL finding pinned to the first organization instead, with
a status_extended that lists the actionable causes so the operator can
choose what to remediate. MANUAL is the right verdict because the cause may
be legitimate (no P2) rather than misconfiguration.

prowler/providers/m365/services/entra/entra_pim_stale_sign_in_alert/entra_pim_stale_sign_in_alert.py

@@ -60,16 +60,22 @@ class entra_pim_stale_sign_in_alert(Check):
                 report.status_extended = "PIM stale sign-in alert reports no stale accounts in privileged roles."
 
             findings.append(report)
-        else:
-            for organization in entra_client.organizations:
-                report = CheckReportM365(
-                    self.metadata(),
-                    resource=organization,
-                    resource_id=organization.id,
-                    resource_name=organization.name,
-                )
-                report.status = "FAIL"
-                report.status_extended = "PIM stale sign-in alert is not configured or not available for the tenant."
-                findings.append(report)
+        elif entra_client.organizations:
+            organization = entra_client.organizations[0]
+            report = CheckReportM365(
+                self.metadata(),
+                resource=organization,
+                resource_id=organization.id,
+                resource_name=organization.name,
+            )
+            report.status = "MANUAL"
+            report.status_extended = (
+                "PIM stale sign-in alert is not available. This can happen when "
+                "the tenant lacks Microsoft Entra ID P2, the alert is disabled, "
+                "or the running credentials cannot read PIM alerts. Review the "
+                "alert configuration in the Entra admin center under Identity "
+                "Governance > Privileged Identity Management > Alerts."
+            )
+            findings.append(report)
 
         return findings

tests/providers/m365/services/entra/entra_pim_stale_sign_in_alert/entra_pim_stale_sign_in_alert_test.py

@@ -160,7 +160,7 @@ class Test_entra_pim_stale_sign_in_alert:
             assert result[0].resource_id == "alert-001"
 
     def test_alert_not_configured(self):
-        """FAIL: PIM stale sign-in alert is not configured."""
+        """MANUAL: PIM stale sign-in alert is not available."""
         entra_client = mock.MagicMock()
 
         with (
@@ -183,15 +183,21 @@ class Test_entra_pim_stale_sign_in_alert:
                     id="org-001",
                     name="Contoso",
                     on_premises_sync_enabled=False,
-                )
+                ),
+                Organization(
+                    id="org-002",
+                    name="Contoso Two",
+                    on_premises_sync_enabled=False,
+                ),
             ]
 
             check = entra_pim_stale_sign_in_alert()
             result = check.execute()
 
             assert len(result) == 1
-            assert result[0].status == "FAIL"
-            assert "not configured or not available" in result[0].status_extended
+            assert result[0].status == "MANUAL"
+            assert "not available" in result[0].status_extended
+            assert "P2" in result[0].status_extended
             assert result[0].resource_id == "org-001"
             assert result[0].resource_name == "Contoso"
             assert result[0].location == "global"